A blog about Federation and SSO

Configuring Fed Authentication Methods in OIF / IdP

In this article, I will provide examples on how to configure OIF/IdP to map OAM Authentication Schemes to Federation Authentication Methods, based on the concepts introduced in my previous entry.

I will show examples for the three protocols supported by OIF:

SAML 2.0 SSO

SAML 1.1 SSO

OpenID 2.0

Enjoy the reading!

Configuration

As I mentioned in my previous article, mapping Federation Authentication Methods to OAM Authentication Schemes is protocol dependent, since the methods are defined in the various protocols (SAML 2.0, SAML 1.1, OpenID 2.0).

As such, the WLST commands to set those mappings will involve:

Either the SP Partner Profile and affect all Partners referencing that profile, which do not override the Federation Authentication Method to OAM Authentication Scheme mappings

Or the SP Partner entry, which will only affect the SP Partner

It is important to note that if an SP Partner is configured to define one or more Federation Authentication Method to OAM Authentication Scheme mappings, then all the mappings defined in the SP Partner Profile will be ignored.

WLST Commands

The two OIF WLST commands that can be used to define mapping Federation Authentication Methods to OAM Authentication Schemes are:

addSPPartnerProfileAuthnMethod() to define a mapping on an SP Partner Profile, taking as parameters:

The name of the SP Partner Profile

The Federation Authentication Method

The OAM Authentication Scheme name

addSPPartnerAuthnMethod() to define a mapping on an SP Partner , taking as parameters:

The name of the SP Partner

The Federation Authentication Method

The OAM Authentication Scheme name

Note: I will discuss in a subsequent article the other parameters of those commands.

In the next sections, I will show examples on how to use those methods:

For SAML 2.0, I will configure the SP Partner Profile, that will apply all the mappings to SP Partners referencing this profile, unless they override mapping definition

For SAML 1.1, I will configure the SP Partner.

For OpenID 2.0, I will configure the SP/RP Partner

SAML 2.0

Test Setup

In this setup, OIF is acting as an IdP and is integrated with a remote SAML 2.0 SP partner identified by AcmeSP.

In this test, I will perform Federation SSO with OIF/IdP configured to:

LDAPScheme as Authentication Scheme

Using the OOTB settings regarding user authentication in OAM, the user will be challenged via a FORM based login page based on the LDAPScheme.

Also the default Federation Authentication Method mappings configuration maps only the urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport to LDAPScheme (also marked as the default scheme used for authentication), FAAuthScheme, BasicScheme and BasicFAScheme.

After authentication via FORM, OIF/IdP would issue an Assertion similar to:

BasicScheme as Authentication Scheme

For this test, I will switch the default Authentication Scheme for the SP Partner Profile to BasicScheme instead of LDAPScheme. I will use the OIF WLST setSPPartnerProfileDefaultScheme() command and specify which scheme to be used as the default for the SP Partner Profile referenced by AcmeSP (which is saml20-sp-partner-profile in this case: getFedPartnerProfile("AcmeSP", "sp") ):

Enter the WLST environment by executing:$IAM_ORACLE_HOME/common/bin/wlst.sh

The user will now be challenged via HTTP Basic Authentication defined in the BasicScheme for AcmeSP.

Also, as noted earlier, the default Federation Authentication Method mappings configuration maps only the urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport to LDAPScheme (also marked as the default scheme used for authentication), FAAuthScheme, BasicScheme and BasicFAScheme.

After authentication via HTTP Basic Authentication, OIF/IdP would issue an Assertion similar to:

Mapping BasicScheme

To change the Federation Authentication Method mapping for the BasicScheme to urn:oasis:names:tc:SAML:2.0:ac:classes:Password instead of urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport for the saml20-sp-partner-profile SAML 2.0 SP Partner Profile (the profile to which my AcmeSP Partner is bound to), I will execute the addSPPartnerProfileAuthnMethod() method:

Enter the WLST environment by executing:$IAM_ORACLE_HOME/common/bin/wlst.sh

OAMLDAPPluginAuthnScheme as Authentication Scheme

For this test, I will switch the default Authentication Scheme for the SP Partner Profile to OAMLDAPPluginAuthnScheme instead of BasicScheme. I will use the OIF WLST setSPPartnerProfileDefaultScheme() command and specify which scheme to be used as the default for the SP Partner Profile referenced by AcmeSP (which is saml20-sp-partner-profile in this case: getFedPartnerProfile("AcmeSP", "sp") ):

Enter the WLST environment by executing:$IAM_ORACLE_HOME/common/bin/wlst.sh

The user will now be challenged via FORM defined in the OAMLDAPPluginAuthnScheme for AcmeSP.

Contrarily to LDAPScheme and BasicScheme, the OAMLDAPPluginAuthnScheme is not mapped by default to any Federation Authentication Methods. As such, OIF/IdP will not be able to find a Federation Authentication Method and will set the method in the SAML Assertion to the OAM Authentication Scheme name.

After authentication via FORM, OIF/IdP would issue an Assertion similar to (see the AuthnContextClassRef set to OAMLDAPPluginAuthnScheme):

Mapping OAMLDAPPluginAuthnScheme

To add the OAMLDAPPluginAuthnScheme to the Federation Authentication Method urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport mapping, I will execute the addSPPartnerProfileAuthnMethod() method:

Enter the WLST environment by executing:$IAM_ORACLE_HOME/common/bin/wlst.sh

LDAPScheme as Authentication Scheme

Using the OOTB settings regarding user authentication in OAM, the user will be challenged via a FORM based login page based on the LDAPScheme.

Also the default Federation Authentication Method mappings configuration maps only the urn:oasis:names:tc:SAML:1.0:am:password to LDAPScheme (also marked as the default scheme used for authentication), FAAuthScheme, BasicScheme and BasicFAScheme.

After authentication via FORM, OIF/IdP would issue an Assertion similar to:

OAMLDAPPluginAuthnScheme as Authentication Scheme

For this test, I will switch the default Authentication Scheme for the SP Partner to OAMLDAPPluginAuthnScheme instead of LDAPScheme. I will use the OIF WLST setSPPartnerDefaultScheme() command and specify which scheme to be used as the default for the SP Partner:

Enter the WLST environment by executing:$IAM_ORACLE_HOME/common/bin/wlst.sh

The user will be challenged via FORM defined in the OAMLDAPPluginAuthnScheme for AcmeSP.

Contrarily to LDAPScheme, the OAMLDAPPluginAuthnScheme is not mapped by default to any Federation Authentication Methods (in the SP Partner Profile). As such, OIF/IdP will not be able to find a Federation Authentication Method and will set the method in the SAML Assertion to the OAM Authentication Scheme name.

After authentication via FORM, OIF/IdP would issue an Assertion similar to (see the AuthenticationMethod set to OAMLDAPPluginAuthnScheme):

LDAPScheme as Authentication Scheme

I will now show that by defining a Federation Authentication Mapping at the Partner level, this now ignores all mappings defined at the SP Partner Profile level.

For this test, I will switch the default Authentication Scheme for this SP Partner back to LDAPScheme, and the Assertion issued by OIF/IdP will not be able to map this LDAPScheme to a Federation Authentication Method anymore, since

A Federation Authentication Method mapping is defined at the SP Partner level and thus the mappings defined at the SP Partner Profile are ignored

The LDAPScheme is not listed in the mapping at the Partner level

I will use the OIF WLST setSPPartnerDefaultScheme() command and specify which scheme to be used as the default for this SP Partner:

Enter the WLST environment by executing:$IAM_ORACLE_HOME/common/bin/wlst.sh

Mapping LDAPScheme at Partner Level

To fix this issue, we will need to add the LDAPScheme to the Federation Authentication Method urn:oasis:names:tc:SAML:1.0:am:password mapping for this SP Partner only. I will execute the addSPPartnerAuthnMethod() method:

Enter the WLST environment by executing:$IAM_ORACLE_HOME/common/bin/wlst.sh

OpenID 2.0

In the OpenID 2.0 flows, the RP must request use of PAPE, in order for OIF/IdP/OP to include PAPE information.

For OpenID 2.0, the configuration will involve mapping a list of OpenID 2.0 policies to a list of Authentication Schemes. The WLST command will take a list of policies, delimited by the ',' character, instead of SAML 2.0 or SAML 1.1 where a single Federation Authentication Method had to be specified.

Test Setup

In this setup, OIF is acting as an IdP/OP and is integrated with a remote OpenID 2.0 SP/RP partner identified by AcmeRP.

In this test, I will perform Federation SSO with OIF/IdP configured to:

Use LDAPScheme as the Authentication Scheme

Map LDAPScheme to the http://schemas.openid.net/pape/policies/2007/06/phishing-resistant and http://openid-policies/password-protected policies Federation Authentication Methods (the second one is a custom for this use case)

LDAPScheme as Authentication Scheme

Using the OOTB settings regarding user authentication in OAM, the user will be challenged via a FORM based login page based on the LDAPScheme.

No Federation Authentication Method is defined OOTB for OpenID 2.0, so if the IdP/OP issue an SSO response with a PAPE Response element, it will specify the scheme name instead of Federation Authentication Methods

After authentication via FORM, OIF/IdP would issue an SSO Response similar to:

Mapping LDAPScheme

To map the LDAP Scheme to the http://schemas.openid.net/pape/policies/2007/06/phishing-resistant and http://openid-policies/password-protected policies Federation Authentication Methods, I will execute the addSPPartnerAuthnMethod() method (the policies will be comma separated):

Enter the WLST environment by executing:$IAM_ORACLE_HOME/common/bin/wlst.sh

About

Damien Carru is a member of the Oracle Identity Management organization, focusing on Federation and SSO.
This blog will cover Federation use cases involving Oracle Access Manager, Oracle Identity Federation and Oracle Security Token Service